Lesson 7 · 14 min
An agent manager doesn't have to become a lawyer, but needs to know what already applies, what has a deadline, what is under discussion and who owns each item. This lesson is short on purpose: it builds your area's compliance timeline and shows that the program's pieces already cover much of the evidence a regulation or a client will ask for.
Start the lesson
Goal: build the compliance timeline for your area: what already applies, what has a date, what is under discussion, and who looks after each item.
Each item goes into a column, with a source, a date and an owner. Click each one.
Regulation facts from the October 2026 market overview (INEMA). This is not legal advice: if you are unsure about your obligation, the company's legal team decides.
The details of the rules are in Profissional 2030 Base; here is what the manager does with them.
Each item on the timeline has its source and the date of the source. Anything that only showed up in a blog or in an article citing another article goes in as "reported, check it", with the date of the news.
A timeline ages fast: the Digital Omnibus changed EU AI Act dates in 2026. Set the next review, every three months.
"PL 2338/2023: reported as stalled in the Chamber (article of 08/24/2026, secondary source). Owner: Carlos with the accounting firm. Review in January 2027."
The 02/12/2027 date applies to anyone who sells or uses AI in the European market. Horizonte sells in the interior of São Paulo: today, it doesn't apply. Write that on the timeline, with the reason, instead of deleting the item.
If the company ever sells abroad, the item changes columns. That's why it stays on record.
At Horizonte it is not a legal obligation, but it is a cheap good practice: the team's training (the G1 training track) is the literacy.
Call whoever handles legal matters when: the agent decides something about people (credit, hiring), data leaves the country, a customer asks for a written statement, or you're unsure whether a rule applies to you.
Your role is to have the timeline, the owners and the evidence organized. The legal opinion belongs to someone else.
The support summary sends customer conversations to a foreign service without a contract (F10). That goes to legal and to the LGPD lesson in Professional 2030 Base.
When a customer or a rule asks "show me how you control AI," the answer is pieces you already have: the responsibility matrix, the identity and log checklist, the evaluation set, the dashboard and the version history.
Put them in one folder with an index. The next compliance question becomes a lookup in the folder, not a project.
Matrix (lesson 1) · checklist and access review (lesson 2) · 30 cases and result by version (lesson 3) · dashboard (lesson 4) · cycles and history (lessons 5 and 6).
A one-page timeline and the evidence folder index. The next tab shows Horizonte's.
COMPLIANCE TIMELINE · area <...> · version <...> · <date> · owner: <name> This is not a legal opinion. Review: every 3 months (next: <date>). | Item | Column | What it requires (one line) | Does it apply to us? Why | Source and source date | Fact or reported | Owner | Next step | |---|---|---|---|---|---|---|---| | <LGPD> | already in force | <...> | yes / no: <...> | <...> | fact | <name> | <...> | | <EU AI Act, high risk> | with a date: <dd/mm/yyyy> | <...> | <...> | <...> | fact | <name> | <...> | | <bill> | under discussion | <...> | <...> | <...> | reported, check it | <name> | monitor | | <customer X questionnaire> | by the customer | <...> | <...> | <customer request, date> | fact | <name> | <...> | Call legal when: decision about people · data leaves the country · customer asks for a statement · doubt whether the rule applies.
AI EVIDENCE FOLDER · area <...> · updated on <date> · owner: <name> 1. Inventory of AI agents and tools, with owner ............. <file, version> 2. Responsibility matrix ..................................... <file, version> 3. Identity, permission and log checklist, per agent ......... <file, date> 4. Monthly access reviews .................................... <folder> 5. Evaluation set and result by version ...................... <file> 6. Indicators dashboard with baseline ........................ <file> 7. LOOP-R cycles, promotions, rollbacks and history .......... <folder> 8. Team training (who, when, what) ........................... <file> 9. Compliance timeline ....................................... <file, version>
You are a compliance reviewer. Below is the AI rules timeline for one area of my company. You do not give legal opinions and you do not say whether a rule applies. Point out: 1. Items with no source or no source date. 2. Reported items written as if they were fact. 3. Items with no owner or no next step. 4. Questions I should take to legal. Timeline: """<paste>"""
Sales · version 1.0 · Horizonte, fictional study company · not a legal opinion
| Item | Column | Does it apply to us? | Owner |
|---|---|---|---|
| LGPD in conversations and customer records | already in force | yes | Carlos, with the accounting firm |
| Conversation sent to a foreign service without a contract (F10) | already in force (LGPD) | yes: take it to legal | Juliana, owner of the summary |
| AI literacy (EU) | already in force in the EU | not by law; adopted as good practice | Patrícia |
| EU AI Act, Annex III high risk | with a date: 02/12/2027 | no: we don't sell or use AI in the EU | Carlos |
| PL 2338/2023 | under discussion | monitor (reported, check it) | Carlos |
| Supplier questionnaire from the hotel chain | by the customer | yes, if they ask | Patrícia, with the evidence folder |
Next review: January 2027.
Horizonte's timeline is for practice; your area's is for real.
Without looking at the tab, build the timeline for Horizonte's sales area using the template. Use the four columns, the lab failures that touch personal data, and what a large customer might ask for. Run the review prompt.
Done when: the timeline has at least 6 items across the 4 columns; each has a source with a date, "does it apply to us" with a reason, an owner and a next step; PL 2338 is marked "reported, check it"; and the next review date is written down.
Build your area's timeline and the evidence folder index with the pieces you already have from this program. Take the questions the prompt flagged to whoever handles legal matters.
Done when: the timeline is saved with owners and a next review; the folder index points to at least 5 pieces that already exist; and the questions to legal were sent, with a date.
Rule details: Rules with set dates, in Professional 2030 Base.
3 questions. The explanation appears after you try.
Question 1 of 3
How does PL 2338/2023 go into the timeline?
Question 2 of 3
Horizonte only sells in inland São Paulo state. What should you do with the EU AI Act item?
Question 3 of 3
A hotel chain sends a questionnaire about how Horizonte controls AI. Where do you start?
Choose an answer. The explanation appears after you try.